WA was E2EE, at least at one point. Its key weakness was not notifying of key changes by default.

Before being bought by Facebook I would believe it was e2ee. But believe it’s not e2ee between the client and Facebook. They just decrypt analysis and reencypt and forward. Since communication is not peer to peer and goes via FB the key exchange is prob with Facebook not the users.

>They just decrypt analysis and reencypt and forward. Since communication is not peer to peer and goes via FB the key exchange is prob with Facebook not the users.

Do you have any evidence for this, or is this your "better safe than sorry" assumption for every e2e messenger that doesn't allow you to verify keys?

After FB bought WhatsApp I’ve had multiple occasions where shortly after having conversations with people about products I haven’t searched for. The only place I’ve discussed it. Is in a whats app conversation. I got advertising in Facebook for those products.

For example when looking for an apartment I told my agent (non business account) that I wanted safety catches on the windows. I immediately got advertising for safety catches and window gates.

I don’t own cats but in a conversation with a friend who owns cats I said she should get one of those cat tree things and scratch poles. Right away Facebook starts showing me adverts for cat toys.

This is not stuff I’ve searched or googled or anything. Just mentioned in WhatsApp. Maybe WhatsApp whats differently in America but in Singapore I get advertising in Facebook from conversations.

That's... not really good evidence. Your story sounds almost identical to the "facebook/google is eavesdropping on me" stories that frequently make the rounds on popular discourse. Unfortunately, that's basically the Sasquatch of the privacy world (ie. there are many people with anecdotes claiming it exists, but very little in the way of actual evidence like network captures or decompiled binaries). If anything, it's worse than Sasquatch because at least with Sasquatch you could claim that there aren't many of them and/or they're actively avoiding humans so they're hard to photograph, but the "facebook/google is eavesdropping on me" stories implies it's happening to everyone so capturing an instance should only be a matter of technical skill rather than luck.

Can you explain why advertising shows only in facebook, for keywords only used inside an apparently private conversation?

Unless WhatsApp is audited completely, not just looking at some source code but also how all information passes through facebook and back to a receiver. Then we can only assume the e2ee is just marketing fluff and not something that is done in favour of privacy.

> Can you explain why advertising shows only in facebook, for keywords only used inside an apparently private conversation?

obvious explanations:

1. coincidence/luck + confirmation bias. this can also be aided by demographic/interest factors. For instance, suppose there are 10,000 "interests" that facebook tracks. You'd think that for a given conversation that contained such a topic, the chance that you'd see ads for it was 1 in 10,000. However, if the conversation topic was "mechanical keyboards", and facebook knew that you were male, 18-35, and are interested in video games, then it might be able to infer that you're much more likely to be interested in mechanical keyboards and therefore show you ads for mechanical keyboards 1 in 50 times rather than 1 in 10,000 times.

2. the other side ended up leaking the information to facebook (eg. through a search or clicking on an ad)

1. So it's coincidence luck that I get advertising for 'window safty latch for children', as an 'interest' for '18-35'? They knew that I was looking for an apartment and had a kid that was 1yo and thought 'oh you know what that guy needs, window safty latch for his kid'

2. So facebook leaked information that a conversation happened between me and a friend and they thought, oh you know what, Phillip had a conversation with X, and X just search for 'cat toys' so Phillip must want cat toys right now!

No, neither of those are 'obvious' explanations.

> 1. So it's coincidence luck that I get advertising for 'window safty latch for children', as an 'interest' for '18-35'? They knew that I was looking for an apartment and had a kid that was 1yo and thought 'oh you know what that guy needs, window safty latch for his kid'

It seems doubtful that you can hide the fact that you had a 1 year old kid from facebook, unless you're a very sporadic/careful user. Besides, it's not too hard to imagine one of your friends outed you to facebook (eg. posted photo of you with a baby, or mentioning the fact that you have a baby on a post/comment somewhere). From there it doesn't seem too implausible that "had 1 year old kid" was a targeting factor for "window safty latch for children". As for the "looking for an apartment" part, I don't really think that's necessary for sending you ads for safety latches. Even if you live in a house you'd need latches to secure room windows that are on the second floor.

>2. So facebook leaked information that a conversation happened between me and a friend and they thought, oh you know what, Phillip had a conversation with X, and X just search for 'cat toys' so Phillip must want cat toys right now!

e2e provides zero assurances about metadata/social graph. that's been the case since PGP days.

1. I was never hiding that fact. But if those ads showed without any pre-discussion on whats app, i wouldn't care. The point is. Those ad's did not show until shortly after the whats app conversation. That suggests that Facebook is aware of the conversations that occur on whats app that are not business accounts. So e2ee is false.

2. Again, those ad's never showed until shortly after the conversation occurred. I'm talking within ~30m of the discussion.

That's too soon to be a coincidence.

And what about all the times you talked about things on WhatsApp and Facebook didn’t start showing you ads about whatever?

Confirmation bias is a hell of a thing; it works in many different ways. Personally over years of usage I’ve never had WhatsApp convos trigger ads.

Majority of people I talk to are Messenger, LINE, and Telegram. So I only have a few people on Facebook. The Business accounts 100% cause me to get advertising on facebook. For example last week the butcher I used to purchase from in Singapore messaged me from his business account advertising arrival of new meat. Boom I get advertising for meat products in Singapore and Taiwan.

The issue is, I have only 3 chats happening in WhatsApp in the last 2 years that are non-business chats. And all 3 have had conversations resulting in advertising.

Business account chat logs are read by Facebook because the chats are sent via other means than WhatsApp. I don’t believe you can verify identity on business accounts either anyway so that’s moot.

As for your other examples, as I said, it’s all very circumstantial and coincidental. Not evidence. Your accusation is more serious than you think, and serious accusations need serious evidence.

I have absolutely no problem accusing Facebook. It's not like they will try to prove me wrong or anything. We only assume that WA is using e2ee, but the reality is they have told us. Never proven it.

Except that WhatsApp uses the same protocol as signal.

If you’re saying Facebook can just decrypt stuff at will, your accusations are quite extreme, and you better back it up with stronger evidence.

>Majority of people I talk to are Messenger, [...]

>The issue is, I have only 3 chats happening in WhatsApp in the last 2 years that are non-business chats. And all 3 have had conversations resulting in advertising.

you realize that Messenger is owned by facebook? I find it baffling that you think the leak must be from whatsapp, when in reality both Messenger and whatsapp are both owned by facebook.

Jezzz I wish I could throw up a facepalm emoji…

My point is because everyone I know uses other messaging apps, not what’s app. My sample size is very small because I’m not having daily conversations on what’s app. Conversations are happening in other apps.

None of this is evidence of decryption.

At best it’s circumstantial anecdotes pointing to Facebook extracting topic metadata out of your convos. This can be done clientside, no decryption necessary. (And it’s easy to prove that it’s being done if that’s the case)

E2EE plus arbitrarily invasive clent-side sniffing/reporting should not be considered "E2EE" by any means. Even if reports to the mothership are strongly encrypted (at which point it becomes harder to determine what's in the reports).

I agree with you, but the claim that Facebook is decrypting and reencrypting things is a very very very severe one.

I didn't claim they are. But they can. And without transparency, I have very little inclination to trust. I find it plausible that they'd scan for keywords and phone home when they get hits -- advertising businesses are not known for their scruples and fb has not distinguished itself in that regard. Once that machinery is in place, it's ripe for abuse. I don't claim any proof it's happening, but it would be naive to blindly trust that it isn't.

The person you talked about may have searched for the term, and knowing that you are friends facebook can easily assume that you would be also interested in this thing. It may also operate based on metadata of you have talked recently.